Tea Dating App Leaks 72,000 User Photos and IDs In Major Breach

A serious data breach has hit Tea, a women’s dating safety app that recently reached the top of the App Store.

Hackers on 4chan accessed an exposed database from Tea, and later started sharing online users’ selfies and ID photos, as first reported by 404Media.

The breach was possible due to an unsecured Google Firebase database used by Tea. “Yes, if you sent Tea App your face and drivers license, they doxxed you publicly! No authentication, no nothing. It’s a public bucket,” read a 4chan post, reports 404Media.

It added, “DRIVERS LICENSES AND FACE PICS! GET THE FUCK IN HERE BEFORE THEY SHUT IT DOWN!”

Tea confirmed the breach to 404 Media, saying it affected older data from more than two years ago and included 72,000 images, 13,000 selfies and photo IDs, and 59,000 other images from posts and messages.

“This data was originally stored in compliance with law enforcement requirements related to cyber-bullying prevention,” the company explained.

The leaked data also includes direct messages. 404 Media verified the exposure by decompiling the Android app and locating the same storage URL shared on 4chan.

“The images in the bucket are raw and uncensored,” one user wrote. Others on 4chan even created scripts to automatically collect the leaked data.

The verification process for Tea requires users to upload both a selfie and ID picture to confirm their female identity before joining the platform. The platform enables women to share anonymous warnings about men through a system that functions like “Are We Dating the Same Guy?” Facebook groups.

After discovering the breach, Tea stated it is working with cybersecurity experts and said in an email to 404Media that , “Protecting our users’ privacy and data is our highest priority.”

404Media notes that the original 4chan thread has since been taken down, but archived versions continue to circulate.